All agencies - Commercial marketing obligations under the privacy principles

Health agencies¹ are required to comply with the National Privacy Principles (NPPs), and all other agencies² with the Information Privacy Principles (IPPs), in the Information Privacy Act 2009 (Qld) (IP Act).

Both agency types have obligations under their respective privacy principles in relation to commercial marketing, but they are very different:

• For non-health agencies: under IPP 11(4), if an agency intends to disclose personal information³ to an entity that could potentially use it for commercial marketing, the disclosure can only occur if the agency is satisfied of certain factors.
• For health agencies: a health agency is permitted, subject to certain limitations, to use non-sensitive personal information for a commercial purpose involving marketing things to the individual.

Non-health agencies

Information Privacy Principle 11(4)

(4)  The agency may disclose the personal information under subsection (1) if the information may be used for a commercial purpose involving the relevant entity’s marketing of anything to the individual only if, without limiting subsection (3), the agency is satisfied on reasonable grounds that—

(a) it is impracticable for the relevant entity to seek the consent of the individual before the personal information is used for the purposes of the marketing; and

(b) the relevant entity will not charge the individual for giving effect to a request from the individual to the entity that the individual not receive any marketing communications; and

(c) the individual has not made a request mentioned in paragraph (b); and

(d) in each marketing communication with the individual, the relevant entity will draw to the individual’s attention, or prominently display a notice, that the individual may ask not to receive any further marketing communications; and

(e) each written marketing communication from the relevant entity to the individual, up to and including the communication that involves the use, will state the relevant entity’s business address and telephone number and, if the communication with the individual is made by fax, or other electronic means, a number or address at which the relevant entity can be directly contacted electronically.

Information with commercial marketing potential

IPP 11(4) only applies if information is going to be disclosed under IPP 11(1) and the potential for commercial marketing exists.

Some of the circumstances in IPP 11(1) are unlikely to attract the requirements of IPP 11(4), as they will not involve any potential for commercial marketing. For example, disclosure to prevent a serious threat, to assist law enforcement investigations, to ASIO, or for public interest research in circumstances where no further disclosure will occur.

However, personal information can also be disclosed with agreement, where it is authorised by law, and where an individual was made aware at collection that the disclosure would occur. Depending on the information and the entity to which it is being disclosed, the potential for commercial marketing could arise.

To work out if it needs to comply with IPP 11(4), the agency will need to consider the circumstances of the disclosure, the nature of the entity, and the type of information.

If the agency believes there is a potential for commercial marketing, before the personal information can be disclosed, the agency must ensure it is satisfied on reasonable grounds of the factors listed in IPP 11(4)(a) – (e). These factors mirror the requirements of the Spam Act 2000 (Cth); if the entity is subject to that Act, in many cases that will be reasonable grounds for the agency to be satisfied.

Health agencies

National Privacy Principle 2(5)

(5) Despite subsection (1), a health agency may use an individual’s personal information that is not sensitive information for a commercial purpose involving a health agency’s marketing of anything to the individual, but only if—

(a) it is impracticable for the health agency to seek the consent of the individual before the personal information is used for the purposes of the marketing; and

(b) the health agency will not charge the individual for giving effect to a request from the individual to the health agency that the individual not receive any marketing communications; and

(c) the individual has not made a request mentioned in paragraph (b); and

(d) in each marketing communication with the individual, the health agency will draw to the individual’s attention, or prominently display a notice, that the individual may ask not to receive any further marketing communications; and

(e) each written marketing communication from the health agency to the individual, up to and including the communication that involves the use, will state the health agency’s business address and telephone number and, if the communication with the individual is made by fax or other electronic means, a number or address at which the health agency can be directly contacted electronically.

Commercial marketing by health agencies

Despite NPP 2(1) limiting the uses to which a health agency can put personal information, a health agency, under NPP 2(5), can also use personal information:

• that is not sensitive information
• for a commercial purpose
• involving the health agency's marketing of anything to the individual
• without the consent of the individual

but only if

• it is impracticable to seek the individual's consent before using the personal information for marketing
• there will be no charge to the individual for stopping the marketing communications
• the individual has not made such a request; and
• each marketing communication tells the individual how to stop the marketing communications and includes the health agency's contact details, including electronic contact details.

Sensitive information

A health agency cannot use personal information that is sensitive information for marketing to an individual. Sensitive information is defined in schedule 5 of the IP Act as:

(a) personal information about the individual that includes any of the following—

(i) the individual’s racial or ethnic origin;

(i) the individual’s political opinions;

(ii) the individual’s membership of a political association;

(iii) the individual’s religious beliefs or affiliations;

(iv) the individual’s philosophical beliefs;

(v) the individual’s membership of a professional or trade association;

(vi) the individual’s membership of a trade union;

(vii) the individual’s sexual preferences or practices;

(viii) the individual’s criminal record; or

(b) information that is health information about the individual for the NPPs.

Commercial purpose of marketing to the individual

The ability to use personal information in NPP 2(5) is limited to a commercial purpose involving a health agency’s marketing of anything to the individual. This means that there must be a commercial element to the message, which could include, for example, an offer to supply, provide, advertise or solicit.

Consent and when it is impracticable to seek it

The health agency must have the consent of the individual before using their information, unless it is impracticable to obtain it. ‘Not practicable’ does not mean difficult or undesirable; to be impracticable it must be impossible, or extremely difficult, to seek that consent. The fact that seeking consent is inconvenient or would involve expenditure of some effort or resources is not sufficient.

The impracticability of seeking consent must not be confused with the undesirability of seeking consent. For example, it is not sufficient that, if consent were sought, refusal by some individuals would make the marketing less successful.

Whether it is impracticable to seek consent will depend on the individual circumstances. When making this determination, the following are relevant considerations:

• the age of the information, where the individuals are likely to have moved or died
• the lack of current or ongoing contact with the individuals, and a lack of sufficient information to determine their current contact details (bearing in mind the obligation to ensure information is accurate and up to date before use)
• the resources required to seek consent would be a significant drain on a health agency.

Request to stop marketing

A health agency must have simple and easily accessible procedures for individuals to remove themselves from commercial marketing lists.  The procedures must not involve any cost or hardship to the individual.

If a request is received, a health agency must immediately cease sending marketing communications to the individual and remove them from their lists.

Content of notices to accompany marketing

Each communication with the individual must advise them that they can tell the health agency to stop sending them communications. For written communication, this must be included as a prominent notice. For oral communication, the individual must be told. The individual should also be told how they can make the request. It is not sufficient to include the information in the first communication—it must be included in every communication.

Every commercial message must include the health agency's full contact details—postal address, business address, phone number—and electronic contact details, including email and website contacts.